Securing crypto exchange accounts: SMS 2FA vs authenticator apps vs passkeys

Key points

• For crypto exchange accounts, passkeys and hardware security keys resist phishing best. Authenticator apps come next. SMS codes are the weakest common option, but still far better than no second factor.
• SMS is weak mainly because of SIM swaps and phishing, not because text messages are easy to read. That's why the number's owner and how it's protected matter.
• A separate number, kept only for the exchange and never published, can shrink the SIM-swap target. It's a supporting layer, not a replacement for an authenticator app or passkey.

Crypto exchange accounts are prime targets. Transactions are hard to reverse, withdrawals can happen in minutes, and attackers know it. The second factor you choose decides how much work an attacker has to do after they have your password, and passwords leak all the time.

This guide compares the three options most exchanges offer, SMS codes, authenticator apps and passkeys or security keys, using published guidance from standards bodies and the exchanges themselves. Then it looks at where a separate phone number fits.

The short comparison

The ranking isn't a matter of opinion. It follows from how each method works, and it's reflected in standards guidance.

What NIST says about SMS

The U.S. National Institute of Standards and Technology publishes digital identity guidelines that many organisations use as a baseline. The current version, SP 800-63B-4, was finalised in July 2025. In it:

• SMS and voice codes (out-of-band over the phone network) are a "restricted" authenticator. Services that use them must offer an unrestricted alternative, explain the risks, and plan for the possibility that SMS won't be acceptable in the future.
• NIST says services should consider risk signals such as a SIM change or number porting before sending a code to a phone.
• Codes you type in, whether from SMS or an app, aren't considered phishing-resistant. Phishing resistance requires methods that bind the log-in to the real site.
• Synced passkeys are allowed at the AAL2 assurance level, and their domain binding stops a fake website from reusing them.

In plain terms: SMS codes are allowed, but they're the weakest option in the guidelines, and phishing-resistant methods are the goal for high-value accounts. A crypto exchange account holding real money is about as high-value as personal accounts get.

Why SMS is weak: SIM swaps and phishing

SIM swap

In a SIM swap, an attacker convinces your carrier to move your number to a SIM card they control, often by social-engineering customer support or using stolen personal details. From that moment, every SMS code goes to the attacker. The FBI's Internet Crime Complaint Center warned in 2022 that criminals use SIM swaps to intercept SMS codes and get into fiat and crypto accounts. It reported 1,611 SIM-swap complaints with more than $68 million in losses in 2021 alone. In the US, the FCC adopted rules in November 2023 requiring carriers to use secure authentication before a SIM change or port-out, notify customers of such requests, and offer account locks.

The attack targets the number, not the message. That matters for the rest of this article.

Real-time phishing

A fake log-in page asks for your password, passes it to the real exchange, then asks for the code the exchange just texted you. SMS codes and authenticator codes are both vulnerable to this. Passkeys and security keys aren't, because the browser only uses them on the genuine site. The U.S. Cybersecurity and Infrastructure Security Agency's fact sheet on phishing-resistant MFA describes SMS and voice as vulnerable to phishing, SS7 and SIM swap attacks, says they should be a last resort, and names FIDO/WebAuthn as the only widely available phishing-resistant authentication.

What exchanges offer

Exchanges publish their own security guidance, and it's worth reading for the one you use. As of October 2026:

• Kraken offers passkeys (including hardware security keys) and authenticator apps for 2FA and highly recommends passkeys over other methods. SMS isn't listed as a 2FA option.
• Binance supports passkeys for 2FA, created via a phone's screen lock, iCloud Keychain or a USB security key, alongside authenticator apps and SMS.
• OKX supports physical security keys, and its account security guide lists authenticator apps, SMS and email verification and an anti-phishing code.
• Bybit's security guide highly recommends Google Authenticator and also lists passkeys and transaction-approval features.

Check your own account's security settings, since options differ by region and account type.

A sensible setup for an exchange account

1. Use a unique, long password from a password manager. Never reuse your email password.
2. Add a passkey or hardware security key if the exchange supports it. Register two security keys if you use hardware, and keep one somewhere safe.
3. Add an authenticator app as well, or instead, if passkeys aren't offered. Save the backup or recovery codes offline.
4. Turn on withdrawal protections: address allow-lists, withdrawal delays for new addresses, and anti-phishing codes in exchange emails, where offered.
5. Protect the email account with the same strength of second factor. Whoever controls your email can often reset your exchange password.
6. Decide what the phone number is for. If the exchange requires a number, or you keep SMS as a recovery method, protect that number properly (next section).

Where a separate number helps

Many exchanges ask for a phone number, whether for SMS 2FA, account recovery, security alerts or identity checks. If you keep SMS enabled in any form, the number becomes part of your security.

Your everyday number is the easiest one to attack. It's on your business cards, in your friends' phones, in leaked databases and on social media. An attacker trying a SIM swap needs to know which number to target. A number that exists only on your exchange account, never shared and never published, is much harder to identify.

Some practical rules if you go this route:

• Use a number you keep and renew. Exchanges ask for SMS codes again at log-in, on new devices and during recovery. A single-use number can't receive them. A PhoneBorn phone number plan is a real mobile number you keep for the plan period and can renew. Single-use OTP numbers are the wrong tool for an exchange account.
• Protect the account that controls the number. A number you manage online is only as safe as the log-in to that dashboard. Use a unique password and 2FA there too.
• Don't let the number lapse. If you stop renewing, the number may eventually go to someone else. See what happens to a phone number after you stop using it.
• Keep the stronger factor primary. The separate number should back up a passkey or authenticator app, not replace it.
• Use your real identity where the exchange requires KYC. A separate number isn't a way around identity verification. Exchanges verify identity with documents, and using a second number doesn't change that. See our glossary entry on KYC.

Exchange-specific notes: Binance, Coinbase, Kraken, OKX and Bybit.

What about SMS alerts?

Some exchanges can text you when someone logs in, changes settings or makes a withdrawal. These alerts are useful, and they work fine on a separate number, as long as you check it. If the number lives in a web dashboard you rarely open, set up email or app notifications as well, so you don't miss a warning.

Common mistakes

• Only SMS 2FA on a large balance. If SMS is your only second factor, add an authenticator app or passkey today.
• No backup codes. Losing your phone with an authenticator and no backup codes can mean a long, document-heavy recovery process.
• The same number everywhere. Your exchange, email, social media and bank all tied to one widely known number concentrate your risk.
• Letting a number expire. Recycled numbers are a real risk for accounts that still trust them.
• Falling for "support" DMs. Exchanges don't ask for your 2FA codes by DM or phone. Anyone who does is an attacker.

FAQ

Is SMS 2FA better than no 2FA on an exchange?

Yes. SMS codes still stop attackers who only have your password. They're the weakest common second factor, though, so add an authenticator app or passkey where the exchange supports one.

Are passkeys safe for crypto exchanges?

Passkeys resist phishing because they only work on the genuine website or app. For exchanges that support them, they're one of the strongest options. Keep a recovery method you have tested.

Can a separate phone number prevent SIM swaps?

It can't prevent them, but it makes you a harder target, because attackers usually go after numbers they can find. Keep the number private, renew it, and protect the account that manages it.

Should I use a one-time number to verify an exchange account?

No. Exchanges ask for SMS codes again at log-in and during recovery. Use a number you keep, or better, move the account to an authenticator app or passkey.

What happens if I lose access to my exchange 2FA?

Exchanges have recovery processes that usually involve identity verification and can take time. Backup codes and a second registered key or passkey help you avoid that.